System and method for securely sharing cryptographic material

ABSTRACT

Systems and methods described herein relate to techniques in which multiple parties each generate and exchange quantities that are based on a shared secret (e.g., powers of the shared secret) without exposing the shared secret. According to a protocol, two or more parties may exchange sets of elliptic curve points generated over polynomials that can be used, by each of the two or more parties, to determine a power of a shared secret. The protocol may be utilised as part of determining parameters for a smart contract that is broadcast to a blockchain network (e.g., Bitcoin). Based on the protocol, an additional party (e.g., a third party different from the two or more parties) may perform a computational task such as execution of the smart contract.

FIELD OF INVENTION

This invention relates generally to computer security and verification,and more particularly to techniques that allow multiple (e.g., more thantwo) parties to share elements of a group, whose exponent ormultiplicative coefficient depends on powers of a shared secret.Quantities may be shared such that the multiple parties exchangequantities that are based on the shared secret (e.g., powers of theshared secret) without exposing the shared secret. The invention isparticularly suited, but not limited to, use in smart contracts, wherethe multiple parties may be respective parties of the smart contractthat agree upon parameters for the smart contract. The invention mayutilise cryptographic and mathematical techniques to share quantitiesfor security-related advantages.

BACKGROUND OF INVENTION

A blockchain may refer to a peer-to-peer, electronic ledger which isimplemented as a computer-based decentralised, distributed system madeup of blocks which in turn may be made up of transactions and otherinformation. In some examples, a “blockchain transaction” refers to aninput message encoding a structured collection of field valuescomprising data and a set of conditions, where fulfillment of the set ofconditions is prerequisite for the set of fields to be written to ablockchain data structure. For example, with Bitcoin each transaction isa data structure that encodes the transfer of control of a digital assetbetween participants in the blockchain system, and includes at least oneinput and at least one output. In some embodiments, a “digital asset”refers to binary data that is associated with a right to use. Examplesof digital assets include Bitcoin, ether, and Litecoins. In someimplementations, transferring control of a digital asset can beperformed by reassociating at least a portion of a digital asset from afirst entity to a second entity. Each block of the blockchain maycontain a hash of the previous block to that blocks become chainedtogether to create a permanent, unalterable record of all transactionswhich have been written to the blockchain since its inception.Transactions contain small programs known as scripts embedded into theirinputs and outputs, which specify how and by whom the outputs of thetransactions can be accessed. On the Bitcoin platform, these scripts arewritten using a stack-based scripting language.

Although blockchain technology is most widely known for the use ofcryptocurrency implementation, digital entrepreneurs have begunexploring the use of both the cryptographic security system Bitcoin isbased on and the data that can be stored on the Blockchain to implementnew systems. It would be highly advantageous if the blockchain could beused for automated tasks and processes which are not limited to therealm of cryptocurrency. Such solutions would be able to harness thebenefits of the blockchain (e.g. a permanent, tamper proof records ofevents, distributed processing, etc.) while being more versatile intheir applications.

The present disclosure describes technical aspects of one or moreblockchain-based computer programs. A blockchain-based computer programmay be a machine readable and executable program recorded in ablockchain transaction. The blockchain-based computer program maycomprise rules that can process inputs in order to produce results,which can then cause actions to be performed dependent upon thoseresults. One area of current research is the use of blockchain-basedcomputer programs for the implementation of “smart contracts”. Unlike atraditional contract which would be written in natural language, smartcontracts may be computer programs designed to automate the execution ofthe terms of a machine-readable contract or agreement.

SUMMARY OF INVENTION

Thus, it is desirable to provide a protocol for multi-party verificationkey recording on a blockchain by exchanging quantities that can be usedto determine powers of a shared secret between two or more parties. Invarious embodiments, it may be desirable for two or more parties of asmart contract to exchange quantities that are usable to determine acommon reference string that comprises a verification key and anevaluation key. In various embodiments, the techniques described hereinallow two or more parties to exchange powers of a shared secret withoutthe use of cryptographic techniques such as encryption, and furthermoredoes not require the parties to establish a communications channel thatrequires cryptographically verifiable assurances confidentiality of dataexchanged over said communications channel. Thus, the invention providesimproved security and verification solutions.

Such an improved solution has now been devised.

Thus, in accordance with the present invention there are providedsystems and methods as defined in the appended claims.

In accordance with the invention there may be provided acomputer-implemented method for a node of a blockchain network, thecomputer-implemented method comprising: determining, at a participant ofa plurality of participants, a function usable to map finite fieldelements; generating, based on a number of participants, polynomialsevaluated in a set of points; distributing the polynomials tocorresponding participants of the plurality of participants; determininga sum of polynomials of each participant of the plurality ofparticipants, wherein the sum corresponds to a power of a secret; andcollectively generating, among the plurality of participants and basedon the secret, a blockchain transaction.

Preferably, the set of points are a set of elliptic curve points.

Preferably, the determination of the sum of polynomials is based on aLagrange interpolation.

A method as described herein may further comprise determining, based atleast in par ton the power of the secret, a common reference string thatis determinable by the plurality of participants.

A method as described herein may further comprise receivingcorresponding values of polynomials from each participant of theplurality of participant.

Preferably, off-chain communications are utilised in the distribution ofthe values of the polynomials to the corresponding participants.Off-chain communications may refer to data communications that are notbroadcast to and/or not verifiable by the blockchain network.

Preferably, the function usable to map the finite field elements servesas a coefficients or exponent of a generator of a group.

Preferably, the plurality of participants is exactly two participants.

The secret may be determined based on the sum of polynomials evaluatedat a particular point, such as a particular elliptic curve point.

The particular point may be an intersection point, such as the sum ofthe polynomials of each participant makes up the (master) polynomial, ofwhich the intersection with the y-axis is the secret.

The set of points may exclude the intersection point—in other words, theintersection point, in at least some cases, is not a member of the setof points.

The polynomials evaluated in the set of points may be of at least order2.

Preferably, each point of the set of points is a different point suchthat there are no duplicate points in the set of points.

It is also desirable to provide a system, comprising: a processor; andmemory including executable instructions that, as a result of executionby the processor, causes the system to perform any of the methods asclaimed.

It is also desirable to provide a non-transitory computer-readablestorage medium having stored thereon executable instructions that, as aresult of execution by one or more processors of a computer system,cause the computer system to at least perform any of the methods asclaimed.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other aspects of the present invention will be apparent fromand elucidated with reference to, the embodiment described herein. Anembodiment of the present invention will now be described, by way ofexample only, and with reference to the accompanying drawings, in which:

FIG. 1 illustrates a computing environment in which multiple parties ofa smart contract enter into an agreement with a third party to executethe smart contract;

FIG. 2 illustrates a computing environment where a first computingentity and a second computing entity exchange quantities that can beused to determine powers of a shared secret between two or more parties;

FIG. 3 illustrates a computing environment in which a first computingentity and a second computing entity exchange a set of parameters thatrenders a zero-knowledge;

FIG. 4 illustrates a diagram of a protocol based on a two-party commonreference string (CRS) and corresponding proof-of-correctness (POC) orproof of correct execution;

FIG. 5 illustrates a process for generating a two-party common referencestring comprising a verification key and evaluation key, in accordancewith an embodiment;

FIG. 6 illustrates a process for sharing powers of a shared secretbetween multiple parties, in accordance with at least one embodiment;and

FIG. 7 illustrates a simplified block diagram of a computing device thatcan be used to practice at least one embodiment of the presentdisclosure.

DETAILED DESCRIPTION

FIG. 1 illustrates a blockchain environment in which various embodimentscan be implemented;

This disclosure describes techniques that may be utilised to implementsystems and methods that allow multiple parties to securely shareelements of a group, whose exponent or multiplicative coefficientdepends on powers of a shared secret. Quantities may be shared such thatthe multiple parties exchange quantities that are based on the sharedsecret (e.g., powers of the shared secret) without exposing the sharedsecret. Accordingly, in various embodiments, a plurality of nparticipants establishes a representation of powers (e.g.,

s^(i)

_(G) in the multiplicative case) of a shared secret.

In an embodiment, a protocol utilising techniques and methods describedherein are used by two parties of a smart contract to share quantitiesthat can be used by the parties to determine powers of a shared secretwithout sharing the secret itself and without revealing information thatwould allow another computing entity (e.g., a computing entity that isnot a party to the smart contract) to determine the secret. In oneembodiment, the protocol comprises a first party of a smart contractcomputing a first set of parameters that are transmitted to a secondparty of the smart contract, the second party computing a second set ofparameters and submitting those parameters to the first party, wherein,upon the exchange of the parameters as described above, both parties areable to calculate the identical common reference string, which comprisesa verification key. The parties may then agree on a transaction in whichthey make proportionate contributions of digital assets to the smartcontract which are locked to an address (e.g., address of a worker nodeof a blockchain network) and can be unlocked (e.g., spent). In anembodiment, off-chain communications between the parties of the smartcontract are limited to the exchange of the parameters used to generatethe common reference string, while ensuring security is maintained(e.g., the secret value is not divulged or otherwise determinable, basedon the parameters exchanged, by an adversary or other computing entitythat is not a party to the smart contract). In an embodiment, the twoparties (or, in the more general case, two or more parties) utilisetechniques that share powers of a shared secret, such as in the mannerdescribed elsewhere in this document, for example, in connection withFIGS. 1-7 .

References may be made to FIG. 1 , which illustrates an examplecomputing environment 100 in which various embodiments of the presentdisclosure may be practiced. Systems and methods described herein mayrelate to a protocol for parties of a smart contract to exchangequantities that the first and second computing entities can use tocalculate the identical common reference string. FIG. 1 illustrates acomputing environment 100 comprising a first computing entity 102 and asecond computing entity 104 that exchange a set of parameters that,allow both the first computing entity and the second computing entity todetermine a common reference string 108. The common reference string maybe utilised by the parties to generate a smart contract 110 that locksdigital assets which either or both of the computing entitiescontributes as transaction inputs. The common reference string maycomprise an evaluation key 112 and a verification key 114. The smartcontract 110 may be published to a blockchain, such as the blockchain118 illustrated in FIG. 1 . The smart contract 110 may be executed by athird computing entity 106 that is not a party to the smart contract110. As part of or in association with executing the smart contract, thethird computing entity (e.g., worker) may generate a proof of correctexecution 116 of the smart contract based at least in part on theevaluation key of the common reference string. The proof of correctexecution 116 may be computationally verifiable by any suitablecomputing system (e.g., parties of the smart contract or a node of theblockchain network that acts as a verifier node). In an embodiment, theverification key 114 is utilised by a fourth computing entity (e.g.,verifier computer system) to verify the proof that is published to theblockchain network 118 is correct.

The first computing entity 102 and the second computing entity 104 arecomputer systems that are parties to a smart contract, according to atleast one embodiment. Parties of a smart contract may refer to two ormore computing entities that agree (e.g., pursuant to user inputprovided through associated user input devices) on the terms to theexecution of a smart contract. The first computing entity 102 and thesecond computing entity 104 may both agree upon a smart contract andcontribute transaction inputs to the smart contract such that therespective transaction inputs of the smart contract are encumbered by alocking script that can be unlocked (e.g., spent) as a result of aworker node providing a proof of correct execution of the smartcontract. Systems and methods described herein relate to enabling alocking script to secure the verification key V_(K) from alteration andchecking validity of a proof π, thereby allowing execution of azero-knowledge protocol on a blockchain during transaction validation.

In various embodiments, the first computing entity 102 and the secondcomputing entity 104 may agree upon a smart contract, in an embodiment,by exchanging a set of messages that encode parameters for the smartcontract, such as dates, times, conditions, and actions (e.g., transferof control of digital assets) that are used to control the execution ofthe smart contract. For example, a smart contract (e.g., an executableprogram) may insure a party against delays of a particular flight, andexecution of the program may include determining whether the particularflight was delayed using external data such as flight information of aparticular commercial flight on a particular day. If the flight wasdelayed, a party of the program may receive a transfer of assets (e.g.,a smart contract that provides travel insurance against delays).

In an embodiment, the smart contract 110 is encoded in a high-levelprogramming language as source code such as C, C++, or Java. These aremerely illustrative examples and the smart contract may be encoded usingother suitable programming languages. In an embodiment, software such asa compiler, interpreter, and/or assembler may be utilized to transformthe smart contract 110 to an arithmetic circuit which consists of“wires” that carry values from a field F and connect to addition andmultiplication gates. It should be noted that the arithmetic circuit mayrefer to a logical circuit that can be implemented by a physical circuitcomprising a series of physical gates (e.g., using transistor-transistorlogic (TTL) integrated circuits such as 7400-series gates, flip-flops,buffers, decoders, multiplexers, and the like) connected by physicalwires. While the execution of a smart contract 110 is described in thecontext of FIG. 1 and elsewhere, the use of a smart contract is merelyone non-limiting example of source code that can be transformed to anarithmetic circuit. In an embodiment, a client (e.g., the firstcomputing entity 102, either alone or in conjunction with the secondcomputing entity 104) determines source code for performing a taskdefined by a set of operations, wherein execution of the task isdelegated to a third computing entity 106 (referred to as a worker orprover). Generally speaking, a verifier may perform tasks associatedwith determining that the prover executed the task correctly, such as byverifying the validity of a proof of correct execution 116 generated bythe prover.

A verifiable computation is a technique that allows the generation ofproofs of computation. In an embodiment, such a technique is utilized bya client to outsource, to another computing entity referred to herein asa prover, the evaluation of a function f on an input x. In some cases,the client is computationally limited so that it is infeasible for theclient to perform the evaluation of the function (e.g., the expectedruntime of the calculation using computing resources available to theclient exceeds a maximum acceptable threshold), although such need notbe the case, and the client may, generally, speaking, delegateevaluation of the function f on the input x based on any suitablecriterion, such as computational runtime, computational cost (e.g., thefinancial cost of allocating computing resources to perform theevaluation of the function), and more. A prover, in an embodiment, isany suitable computing entity such as a blockchain node as described ingreater detail elsewhere in the present disclosure. In an embodiment, aprover (e.g., a blockchain node) evaluates the function f on input x andgenerates an output y and a proof π of the correctness of the output ythat can be verified by other computing entities such as the client asdescribed above and/or other nodes of the blockchain network. Proofs,which may also be referred to as arguments, can be verified faster thandoing the actual computational—accordingly, computational overhead canbe reduced (e.g., reducing power overhead and the cost associated withpowering and running computing resources) by verifying the correctnessof the proof instead of re-computing the function f over input x todetermine the correctness of the output generated by the proverdescribed above. In zero-knowledge verifiable computation the proverprovides an attestation to the client that the prover knows an inputwith a particular property.

An efficient variant of a zero-knowledge proof of knowledge is zk_SNARK(Succinct Non-interactive ARgument of Knowledge). In an embodiment, allpairings-based zk-SNARKs include a process where the prover computes anumber of group elements using generic group operations and the verifierchecks the proof using a number of pairing product equations. In anembodiment, the linear interactive proof works over a finite field andthe prover's and verifier's message include, encode, reference, orotherwise include information usable to determine vectors of fieldelements.

In an embodiment, the first computing entity and/or the second computingentity agree on terms of execution of a smart contract by exchanging aset of messages that encode proposed parameters for the execution of thesmart contract, such as one or more Boolean expressions that encodes aset of conditions that determine whether and/or how to execute the smartcontract and a set of operations to perform based on a condition beingsatisfied. In an embodiment, one computing entity sends a set ofparameters to the second computing entity as part of a protocol, and thesecond computing entity determines whether the parameters are acceptablefor the smart contract. If the parameters are not accepted, the secondcomputing entity may provide a different set of parameters to the firstcomputing entity as a second proposed set of parameters for execution ofthe smart contract. The second computing entity may also provide asignal that the first set of parameters were not acceptable, and thefirst computing entity determines a second set of parameters to provide.In either case, once all parties have signaled agreement to theparameters, either computing entity can, in an embodiment, generate alocking transaction wherein one of the outputs is locked by the program(e.g., a smart contract script) and sends it to a counterparty of thesmart contract. The locking transaction may refer to a transaction thatinitialises constraints upon which an unlocking transaction can bevalidated. In some examples, an “unlocking transaction” refers to ablockchain transaction that reassociates (e.g., transferring ownershipor control) at least a portion of a digital asset, indicated by an UTXOof a previous transaction, to an entity associated with a blockchainaddress.

In an embodiment, the first computing entity generates a lockingtransaction and adds a transaction input that covers a portion of theworker fee. It should be noted that at this point, the lockingtransaction is not yet valid because the value of the transaction inputsis not equal to the value of the transaction outputs of the lockingtransaction. Continuing with the example, when the second computingentity receives the locking transaction, the second computing entityverifies the smart contract (e.g., verifies the common reference stringand parameters for execution of the smart contract) and adds an input tothe locking transaction and unlocks a UTXO to transfer to the issueragreed upon digital assets and also a fee that is to be paid to theworker for execution of the program (e.g., smart contract) and an outputthat has a value of the fee to the worker. In cases where both the firstcomputing entity and the second computing entity contribute transactioninputs to the smart contract, the smart contract may be jointly owned byboth parties, and the transfer (e.g., exchange or sale) of the smartcontract may require an attestation from both parties.

The smart contract 110 may be executed by a third computing entity 106such as a node of a blockchain network. The third computing entity 106may be referred to as a worker or a prover. In an embodiment, the workerexecutes the smart contract by at least performing a computational taskthat involves the computation of a function on an input. In anembodiment, the worker is any suitable computer system that the owner(s)of the smart contract may delegate a computational task to. An input, inan embodiment, includes information that attests to the worker'sidentity, such as a digital signature generated using a private keyassociated with the worker. In an embodiment, the worker is a computersystem that the first and second computing entities agree to transferdigital assets to in return for successfully completing a computationaltask. The owner(s) of the smart contract, in an embodiment provides aninput x and the evaluation key E_(K) 112 to a prover, the prover uses anevaluation module to a compute routine to compute the output y (i.e.,y=f(x) wherein the input is x and the function is f) and uses theevaluation key E_(K) to produce a proof of correct execution 116, whichmay also be referred to as a proof-of-correctness elsewhere in thisdisclosure. In an embodiment, the worker is a computer system comprisinghardware and/or software that includes instructions that, if executed byone or more processors of the computer system, cause the computer systemto evaluate the values of the internal circuit wires of a QAP andproduce an output y of the QAP.

In embodiments, an output

, values of the internal circuit wires (or a subset thereof), and theevaluation key E_(K) are used to produce the proof-of-correctness. Theproof π can be stored on the blockchain and verified by multiple partieswithout requiring the worker to separately interact with the multipleparties. In this manner, a fourth computing entity (e.g., a verifiercomputer system) can validate the broadcasted transaction using thepublic verification key V_(K) 114 and the proof π, thereby validatingthe smart contract. In some cases, the owner(s) of the smart contractmay reclaim digital assets encumbered by the broadcasted transaction ifthe verification fails. In some cases, the owner(s) of the smartcontract can perform the verification of the proof.

In an embodiment, the verification key 114 and the corresponding proof116 are generated according to techniques described above and/or below.Accordingly, a verifier is given verification key V_(K) and proof π:

$V_{K} = \begin{Bmatrix}\mathcal{P} \\Q \\{\alpha_{v}Q} \\{\alpha_{w}Q} \\{\alpha_{w}\mathcal{P}} \\{\alpha_{y}Q} \\{\beta\mathcal{P}} \\{\beta Q} \\{r_{y}{t(s)}\mathcal{P}} \\{r_{v}{v_{i}(s)}\mathcal{P}} \\{r_{w}{w_{i}(s)}Q} \\{r_{y}{y_{i}(s)}\mathcal{P}}\end{Bmatrix}_{i = {0\ldots\mspace{14mu} N}}$${{Proof}\mspace{14mu}\pi} = \begin{Bmatrix}{\sum\limits_{i = N + 1}^{m}{a_{i}r_{v}{v_{i}(s)}\mathcal{P}}} \\{\sum\limits_{i = N + 1}^{m}{a_{i}\alpha_{v}r_{v}{v_{i}(s)}\mathcal{P}}} \\{\sum\limits_{i = N + 1}^{m}{a_{i}r_{w}{w_{i}(s)}Q}} \\{\sum\limits_{i = N + 1}^{m}{a_{i}\alpha_{w}r_{w}{w_{i}(s)}\mathcal{P}}} \\{\sum\limits_{i = N + 1}^{m}{a_{i}r_{y}{y_{i}(s)}\mathcal{P}}} \\{\sum\limits_{i = N + 1}^{m}{a_{i}\alpha_{y}r_{y}{y_{i}(s)}\mathcal{P}}} \\{\sum\limits_{i = N + 1}^{m}{{a_{i}\left( {{r_{v}\beta{v_{i}(s)}} + {r_{w}\beta{w_{i}(s)}} + {r_{y}\beta{y_{i}(s)}}} \right)}\mathcal{P}}} \\{\sum\limits_{i = 0}^{d}{h_{i}s^{i}Q}}\end{Bmatrix}$such that the verifier computes a plurality of elliptic curvemultiplications (e.g., one for each public input variable) and five pairchecks, one of which includes an additional pairing multiplication.

Given verification key V_(K), proof π, and (a₁, a₂, . . . , a_(N)), toverify that t(x) divides p(x) and hence (x_(N+1), . . . , x_(m))=ƒ(x₀, .. . , x_(N)), the verifier proceeds as follows. First it checks all thethree α terms:e(α_(v) r _(v) V _(mid)(s)

,

)=e(r _(v) V _(mid)(s)

,α_(v)

)e(α_(w) r _(w) W _(mid)(s)

,

)=e(α_(w)

,r _(w) W _(mid)(s)

)e(α_(y) r _(y) Y _(mid)(s)

,

)=e(r _(y) Y _(mid)(s)

,α_(y)

)wherein V_(mid)(s)=Σ_(i=N+1) ^(m)a_(i)v_(i)(s), W_(mid)(s)=Σ_(i=N+1)^(m)a_(i)w_(i)(s), and Y_(mid)(s)=Σ_(i=N+1) ^(m)a_(i)y_(i)(s). Then, theverifier checks the term β:e(r _(v) V _(mid)(s)

+r _(y) Y _(mid)(s)

,β

)·e(β

,r _(w) W _(mid)(s)

)=e(Z _(mid)(s)

,

)and Z_(mid)(s)=Σ_(i=N+1)^(m)a_(i)(r_(v)βv_(i)(s)+r_(w)βw_(i)(s)+r_(y)βy_(i)(s)). Finally, theverifier checks the divisibility requirement:e(r _(v) V(s)

,r _(w) W(s)

)=e(r _(y) Y(s)

,

)·e(r _(y) t(s)

,h(s)

)wherein r_(v)V(s)

=Σ_(i=0) ^(m)r_(v)a_(i)v_(i)(s)

, r_(w)W(s)

=Σ_(i=0) ^(m)r_(w)a_(i)w(s)

, r_(y)Y(s)

=Σ_(i=0) ^(m)r_(y)a_(i)y(s)

, and h(s)

=Σ_(i=0) ^(d)h_(i)

.

Thus, upon considering the notation from the sections described aboveand the examples described in this disclosure, the verificationcomprises a set of pair checks of the following elements, in accordancewith one embodiment:

  e(π₂, V_(K)²) = e(π₁, V_(K)³)   e(π₄, V_(K)²) = e(V_(K)⁵, π₃,)  e(π₆, V_(K)²) = e(π₅, V_(K)⁶)   e((π₁ + π₆), V_(K)²) = e(π₇, V_(K)²)  e((a₀V_(K)¹⁰ + a₁V_(K)¹¹ + a₂V_(K)¹² + a₃V_(K)¹³ + a₄V_(K)¹⁴ + π₂ + a₇V_(K)¹⁵), (a₀V_(K)¹⁶ + a₁V_(K)¹⁷ + a₂V_(K)¹⁸ + a₃V_(K)¹⁹ + a₄V_(K)²⁰ + π₄ + a₇V_(K)²¹)) = e((a₀V_(K)²² + a₁V_(K)²³ + a₂V_(K)²⁴ + a₃V_(K)²⁵ + a₄V_(K)²⁶ + π₆ + a₇V_(K)¹⁵), V_(K)²) * e(V_(K)⁹, π₈)

FIG. 2 illustrates a computing environment 200 where a first computingentity 202 and a second computing entity 204 exchange quantities thatcan be used to determine powers of a shared secret between two or moreparties. The first computing entity 202 and the second computing entity204 may exchange quantities (as illustrated below the horizontal arrowillustrated in FIG. 2 ) that are used to calculate an identical commonreference string. In an embodiment, the first computing entity and thesecond computing entity are nodes of a blockchain network that are inaccordance with those described in connection with FIG. 1 . Inaccordance with at least one embodiment, let F:

→

be a function on field, and let

be the corresponding arithmetic circuit, and

=(t(x),

,

,

) the corresponding QAP (quadratic arithmetic program) of size m anddegree d. Furthermore, let e:

×

→

_(T) be a bilinear mapping, and G a generator of

. In an embodiment, the additive representation (as opposed to theexponential representation) is chosen. In an embodiment, an evaluationkey and a verification key are chosen by: choosing random r_(v), r_(w),s, α_(v), α_(w), α_(y), β, γ∈

, and setting r_(y)=r_(v)·r_(w), r_(v)·G=

g_(v)

(generally:

a

=a·G), and correspondingly

g_(w)

,

g_(y)

, to construct the keys:EK=({

v _(k)(s)

}_(k∈I) _(mid) ,{

w _(k)(s)

}_(k∈I) _(mid) ,{

y _(k)(s)

}_(k∈I) _(mid) ,{

α_(v) v _(k)(s)

}_(k∈I) _(mid) ,{

α_(w) w _(k)(s)

}_(k∈I) _(mid) ,{

α_(y) y _(k)(s)

}_(k∈I) _(mid) ,{

s ^(i)

}_(i∈[d]) ,{

βv _(k)(s)

βw _(k)(s)

βy _(k)(s)

}_(k∈I) _(mid) )andVK=(

1

,

α_(v)

,

α_(w)

,

α_(y)

,

γ

,

βγ

,

t(s)

,{

v _(k)(s)

w _(k)(s)

y _(k)(s)

}_(k∈{0}∪[N])).where N=N_(in)+N_(out), i.e., the number of in- and outputs. In anembodiment where an asymmetric pairing is considered, the pairingmapping would be defined as: e:

₁×

₂→

_(T), and G_(i) a generator of

_(i), i=1,2. In that case the CRS would change slightly and the VK wouldbeVK=(

1

₁,

1

₂,

α_(v)

₂,

α_(w)

₂,

α_(w)

₁,

α_(y)

₂,

β

₁,

β

₂ ,

r _(y) t(s)

₁ ,{

v _(k)(s)

₁

w _(k)(s)

₂

y _(k)(s)

₁}_(k∈{0}∪[N]))where r_(y)=r_(v)·r_(w) and

a

_(i)=a·G_(i).

As indicated, circuits are described by means of polynomials v, w,which, in turn, are evaluated in a secret s, which is only known to theparty owning/creating the circuits and corresponding QAP (e.g., theowners of the smart contract).

More precisely, as described above, the client generates the elements:

$r_{v},r_{w},s,\alpha_{v},\alpha_{w},\alpha_{y},\beta,{\gamma\overset{\mathcal{R}}{\leftarrow}{\mathbb{F}}_{r}^{*}}$

Whereas the security of the proposed solution relies on the parameter,s, in some embodiments, exposing the remaining (r_(v), r_(w), α_(v),α_(w), α_(y), β, γ) may reveal information that does not render thesystem zero-knowledge and/or that the client does not want otherentities to know about.

In an embodiment, for solutions where a worker is required to provide aproof-of-correctness, there may exist an OP_code (or equivalents) forverifying the proof-of-correctness against a verification key.

It should be noted that throughout this disclosure, unless otherwisestated, the polynomials in this paper are defined over a field,

_(r). Thus, let (

_(r), +, ·) be a field. Accordingly, a polynomial over

_(r) is given by P:

→

′

${P(x)} = {\sum\limits_{i = 0}^{n}{a_{i}x^{i}}}$where a_(i)∈

.

In an embodiment, the common reference string is expressed by means ofthe polynomials v(x), w(x) evaluated in a secret, s, expressed in theform:v(s)=a ₀ +a ₁ s+a ₂ s ² + . . . +a _(n) s ^(n)w(s)=b ₀ +b ₁ s+b ₂ s ² + . . . +b _(n) s ^(n)

In an embodiment, techniques described herein are utilised to determineand share elliptic curve points of form:

v(s)

_(G)=

a₀

_(G)+

a₁s

_(G)+

a₂s²

_(G)+ . . . , for a generator G of the associated group (e.g., ofelliptic curve points). Thus, in an embodiment, systems and methodsdescribed herein are utilised to determine and distribute s^(r)G=

s^(r)

_(G), for arbitrary integer powers r.

Techniques to share and distribute

s^(r)

_(G), in accordance with at least one embodiment, are illustrated inFIG. 2 . As an example, the n=2 case is described in greater detailbelow in connection with FIG. 2 , and should be considered anon-limiting example of sharing powers of secrets between parties of asmart contract. Furthermore, it is noted, that in various embodimentsdescribed herein, the equivalent of a threshold is given a priori and itis assumed that the necessary number of participants first agree.

FIG. 2 illustrates techniques to share and distributed powers of ashared secret in the case of two participants, in accordance with atleast one embodiment. As illustrated in FIG. 2 and in accordance with atleast one embodiment, exactly two parties are participants that sharepowers of a shared secret (i.e., n=2 case). The first and secondcomputing entities may respectively be referred to as A and B. In anembodiment, A and B may exchange the following information: A sends

p₁(x_(i))

_(G) to B, and receives

p₂(x_(i))

_(G) in return (i∈{1,2}). In this way, both can calculate

p(x _(i))

_(G) =

p ₁(x _(i))+p ₂(x _(i))

_(G)

Using Lagrange interpolation (Lagrange Polynomial, n.d.) it is possibleto express p in terms of p(x₁) and p(x₂):

${p(x)} = {{{{p\left( x_{1} \right)}\frac{x - x_{2}}{x_{1} - x_{2}}} + {{p\left( x_{2} \right)}\frac{x - x_{1}}{x_{2} - x_{1}}}} = {{\frac{{p\left( x_{1} \right)} - {p\left( x_{2} \right)}}{x_{1} - x_{2}}x} + \frac{{{- {p\left( x_{1} \right)}}x_{2}} + {{p\left( x_{2} \right)}x_{1}}}{x_{1} - x_{2}}}}$and, by extension,

p(x)

_(G) by means of

p(x_(i))

_(G) (see WP0559). While the participants cannot reconstruct p(x), theycan reconstruct

p(x)

_(G) (and in particular

p(0)

_(G)), by means of the exchanged points

p_(i)(x_(j))

_(G). This is true about higher powers of

p^(n)(x)

_(G) as well. As a result of the multinomial formula (MultinomialTheorem, n.d.):

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + \ldots + {p_{m}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots + k_{m}} = n}{\begin{pmatrix}n \\{k_{1},k_{2},\ldots\mspace{14mu},k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}}$

For m=2 this becomes:

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + {p_{2}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2}} = n}{\begin{pmatrix}n \\{k_{1},k_{2}}\end{pmatrix}{\prod\limits_{t = 1}^{2}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}}$which, in turn, yields the following “tower” of terms (here i=1,2):

n Terms that need to be exchanged (multiplied by G, and j = 1, 2) 1 p₁(x_(j)), p₂ (x_(j)) 2 p₁ (x_(j)), p₂ (x_(j)), p₁ ² (x_(j)), p₂ ² (x_(j))(optionally: p₁ (x_(j)) · p₂ (x_(j))) 3 p₁ (x_(j)), p₂ (x_(j)), p₁ ²(x_(j)), p₂ ² (x_(j)), p₁ ³ (x_(j)), p₂ ³ (x_(j)) (optionally: p₁(x_(j)) · p₂ (x_(j)), p₁ ² (x_(j)) · p₂ (x_(j)), p₁ (x_(j)) · p₂ ²(x_(j))) . . . . . .

Schematically the exchange could look like the following (for somex_(i)):

Step A ↔ B 1 A: for j = 1, 2 and k = 1, 2, . . . : send {

(p₁ ^(k) (x_(j))

_(G)} to B 2 B: for j = 1, 2 and k, k′ = 1,2, . . . : send {

(p₂ ^(k)′ (x_(j))

_(G)}, (and optionally) {

(p₁ ^(k) (x_(j)) · p₂ ^(k)′ (x_(j))

_(G)} to A

After this exchange (following certain, pre-arranged conventions) bothparties can calculate

p^(n)(x_(j))

_(G) and, in particular,

p^(n)(0)

_(G)=

s^(n)

_(G).

FIG. 3 illustrates a computing environment 300 in which a firstcomputing entity 302 and a second computing entity 304 exchange a set ofparameters that renders a protocol—such as those described in connectionwith FIG. 1 —zero-knowledge. In accordance with various embodiments, apublic verification key may take on the form:VK=(

1

₁,

1

₂,

α_(v)

₂,

α_(w)

₂,

α_(w)

₁,

α_(y)

₂,

β

₁,

β

₂ ,

r _(y) t(s)

₁ ,{

v _(k)(s)

₁

w _(k)(s)

₂

y _(k)(s)

₁}_(k∈{0}∪[N]))

Whereas the security of the proposed solution relies on the parameter,s, in some embodiments, exposing the remaining (r_(v), r_(w), α_(v),α_(w), α_(y), β, γ) may reveal information that does not render thesystem zero-knowledge and/or that the client does not want otherentities to know about. Accordingly, in an embodiment, some or all ofthe remaining parameters used to generate a verification key 306 areshared using techniques described in connection with FIG. 3 .

In an embodiment, polynomials are exchanged between the first computingentity 302 and the second computing entity 304 (which may be referred toas, respectively, A and B) according to techniques described elsewherein this disclosure, such as those discussed in connection with FIGS. 1,2 and 4 . Accordingly, in an embodiment, the first computing entity 302computes and shares a set of elliptic curve points {

p₁ ^(k)(x_(l))

_(G) _(i) }_(k∈{1, . . . , n},l∈{1,2},i∈{1,2}) to the second computingentity 304 and the second computing entity 304 computes and shares a setof elliptic curve points {

p₂ ^(k)(x_(l))

_(G) _(i) }_(k∈{1, . . . , n},l∈{1,2},i∈{1,2}) to the first computingentity 302. Additionally, other parameters used to generate theverification key 306 may not be revealed in a plaintext format across acommunications channel and instead transmitted using techniquesdescribed hereinbelow.

Let G_(i) be a generator of

_(i), i=1,2, and

p_(k)(s)

_(i)=r_(p)·p_(k)(s)·G_(i) for p=v, w, y, according to an embodiment.Further, in an embodiment,

p_(k) ^(i)(s)

_(G) _(i) are shared, and the other parameters are propagated in amanner that ensures the confidentiality of the parameters (e.g.,encryption or other concealment techniques). It is noted that either ofthe participants may, conversely, generate the parameters r_(v), r_(w),α_(v), α_(w), α_(y), β, γ∈

, and transfer them to the other, either off- or online (e.g.,on-chain). Regarding the former—that is, ensuring confidentiality of theother parameters—various techniques may be utilized. For example, byusing Shamir's Secret Sharing Scheme (4S) to share the elements

α_(v)

₂,

α_(w)

₂,

α_(w)

₁,

α_(y)

₂ (and possibly

β

₁,

β

₂, depending on implementation/protocol) and/or using a Diffie-Hellmanlike secret generation for r_(v), r_(w), β, γ.

In an embodiment, the elements

α_(v)

₂,

α_(w)

₂,

α_(w)

₁,

α_(y)

₂,

β

₁,

β

₂, or some combination thereof are of the form

a

_(i)=a·G_(i). Like in the case of s, each participant, i, generates apolynomial, q_(i), evaluates it in x_(j), j∈{1, . . . , m}, and sharesthe corresponding q_(i)(x_(j)) with participant j. Each participant canthus determine

q(x)

_(G) _(i) =Σ_(j)

q_(j)(x)

_(G) _(i) and, in particular, q(0)·G_(i)=

q(0)

_(i) where q(0) can be α_(v), α_(w), α_(y), β, or some combinationthereof, the particular combination of which may be based on aprotocol/convention, such as a zk_SNARKs protocol.

In an embodiment, the α-parameters are shared by means of elliptic curvepoints whereas other parameters may by scalar values. For such values,in accordance with at least one embodiment, a Diffie-Hellman scheme isused to share scalar parameters between the two computing entities,without sharing the parameters themselves. Accordingly, in anembodiment, let P={t₁, . . . , t_(N)} be a set of N parameters. In anembodiment, it is assumed that A and B have agreed on using amultiplicative group Γ with modulus μ and generator γ, and theparticipants (A and B) proceed with following the steps (while theexponential representation is used here as an illustrative example,others suitable representations may be utilised): for each i∈{1, . . . ,N}, the first and second computing entities create a (private) randomnumber v_(A,i), v_(B,i), respectively and both derive a (public)element: γ^(v) ^(A,i) and γ^(v) ^(B,i) . The computing entities thenexchange γ^(v) ^(A,i) and γ^(v) ^(B,i) , and calculate (γ^(v) ^(B,i))^(v) ^(A,i) and (γ^(v) ^(A,i) )^(v) ^(B,i) (=(γ^(v) ^(B,i) )^(v) ^(A,i)=γ^(v) ^(A,i) ^(v) ^(B,i) ), respectively. Accordingly, the parametersare set t_(i)=γ^(v) ^(A,i) ^(v) ^(B,i) .

Accordingly, the techniques above have demonstrated that both the firstand second computing entities share the parameters t_(i) without havingexchanged them by, instead, exchanging γ^(v) ^(A,i) and γ^(v) ^(B,i) .It should be noted that in accordance with at least one embodiment, thenumber of participants is limited to n=2 as a result of at least oneparameter being exchanged in the preceding manner.

FIG. 4 illustrates a diagram 400 of a protocol based on a two-partycommon reference string (CRS) and corresponding proof-of-correctness(POC) or proof of correct execution. The diagram 400 illustrates a firstcomputing entity 402, a second computing entity 404, and a thirdcomputing entity 106 wherein the first computing entity 402 and thesecond computing entity 404 jointly make contributions to a smartcontract that can be unlocked by the third computing entity 406 uponexecution of the smart contract. In an embodiment, the protocol isimplemented at least in part using a blockchain network.

In accordance with this disclosure, and described in greater detail(e.g., in connection with FIG. 4 ), a scheme and protocol for twoparticipants, A and B, may be utilised to generate a shared secret and,thus, a shared common reference string (CRS) which can be used to verifythe correct execution of an associated circuit. In an embodiment, thescheme assumes an off-chain exchange of data, first between A and B, andsecondly between A+B (or either) and a worker C that performs acomputational task on behalf of at least one of A or B. To cause theworker C to perform the computational task (e.g., execution of a smartcontract), A and B both sign a transaction (which may or may not containa P2SH-type redeem script), which requires the worker C to provide aproof-of-correctness and prove possession of correct verification key(VK) in order to unlock the funds.

Techniques for implementing the protocol as presented in thisdisclosure, in some embodiments, do not require any protocol changes toexisting blockchain networks (e.g., may be implemented on aBitcoin-based blockchain network using existing commands that arealready supported). In some embodiments, extensions to the existing setof commands supported by the Bitcoin protocol are also discussedherein—the extensions may include new commands (e.g., new OP codes) thatmay have various benefits such as improving efficiency of the executionof smart contracts, reducing the size of the smart contract (which mayreduce the amount of storage space needed by nodes of the blockchainnetwork to properly operate), and more. In some embodiments, the cost ofconfirming a smart transaction to the blockchain is based at least inpart on the size of the smart contract.

In an embodiment, the exchange and transfer of elliptic curve points andother data pertaining to the common reference string are transferredoff-chain. In an embodiment, the verification key is eventuallybroadcast or otherwise made available on-chain via the exchange ofdigital assets for work (e.g., execution of a smart contract) carriedout by the worker C and two parties wishing to evaluate their smartcontract (A and B). As described herein, several schemes are possible.For instance, A and B may or may not both supply the VK or hashes of VKwhen preparing the locking transaction. In other words, in anembodiment, the majority of the capacity-intensive workload is doneoff-chain.

In an embodiment, the protocol includes both off-chain and on-chaincomponents, as denoted by the dotted line illustrated in FIG. 4 .Off-chain components may include communications and exchanges of dataand information that can occur without storing data to a blockchainledger. For example, an off-chain component of the protocol may includean exchange of IP packets between a source and destination (e.g., thefirst computing entity 402 is a source that transmits a first set ofparameters to a destination, the second computing entity 404). Forexample, an on-chain component of the protocol may include broadcastingdata to a blockchain ledger that is made available to nodes of theblockchain network.

In an embodiment, the first computing entity 402 computes, based atleast in part on a first polynomial, a set of elliptic curve points {

p₁ ^(k)(x_(l))

_(G) _(i) }_(k∈{1, . . . , n},l∈{1,2},i∈{1,2}). The first computingentity 402 may transmit data to the second computing entity 404comprising at least some of the set of elliptic curve points. Forexample, the first computing entity 402 may transmit the entire set ofelliptic curve points. As a second example, the first computing entity402 may transmit a subset of the elliptic curve points {

p₁ ^(k)(x₂)

_(G)}_(k∈{1, . . . , n}).

In some embodiments, additional data is transmitted that is not requiredto maintain the secrecy of a share secret s, but may be necessary torender the system zero-knowledge. For example, {γ^(v) ^(A,i)}_(i∈{1, . . . , N}), q_(1,I) (I=v, w, y), or some combination thereofmay also be computed (as described above in connection with FIG. 3 ) togenerate additional parameter values that can be used as part ofdetermining a common reference string. In an embodiment, {γ^(v) ^(A,i)}_(i∈{1, . . . , N}) is a set of scalar values. In an embodiment,q_(1,I) (I=v, w, y) refers to a set of elliptic curve points.

In an embodiment, the second computing entity 404 likewise computes,based on a polynomial that may be different from that used by the firstcomputing entity 402, a set of elliptic curve points {

p₂ ^(k)(x_(l))

_(G) _(i) }_(k∈{1, . . . , n},l∈{1,2},i∈{1,2}). The second computingentity 404 may perform similar operations as described above. Forexample, the second computing entity 404 may transmit a subset of thegenerated elliptic curve points {

p₂ ^(k)(x₁)

_(G)}_(k∈{1, . . . , n}) to the first computing entity 402.Additionally, in an embodiment, optional parameters such as {γ^(v)^(B,i) }_(i), q_(2,I) (I=v, w, y), or some combination thereof may beexchanged, which, while not being necessary to maintain the secrecy ofthe shared secret s, may be utilised to ensure that the protocol iszero-knowledge.

In an embodiment, the exchanged quantities can be utilised by both thefirst computing entity 402 and the second computing entity 404 tocalculate the identical common reference string. They may or may notprovide the third computing entity (e.g., worker) with the commonreference string, as the third computing entity 406 has to provepossession of the correct verification key later on. The determinationof the same common reference string by both the first and secondcomputing entities may be performed off-chain.

Continuing with the protocol, in accordance with one embodiment, thefirst and second computing entities agree on a transaction in which theymake proportionate contributions for the execution of the smartcontract. In an embodiment, the first and second computing entitiesagree upon a proportion of contributions and each provide transactioninputs that are encumbered to the smart contract and can be unlocked bythe third computing entity upon execution of the smart contract. Thismay or may not be a pay-to-script-hash (P2SH) type agreement where theyboth transfer funds to the same address (an address of C). The P2SH typescript may or may not contain the elements of the verification key orhash-values of verification key, i.e., h_(i)=HASH(VK_(i)). In anembodiment, the key has been divided into chunks. The smart contract maybe broadcast to a blockchain as the first transaction 410 illustrated inFIG. 4 having a first transaction input contributed by the firstcomputing entity 402 and a second transaction input contributed by thesecond computing entity 404 that serves as a worker fee paid in aproportion agreed upon by the first and second computing entities.

In an embodiment, the third computing entity 406—also referred to as aworker—unlocks the funds in a second transaction 410 according to theprotocols in U.K. Patent Application No. 1719998.5 and/or U.K. PatentApplication No. 1720768.9—and the third computing entity 406 unlocks thefunds for the work (correct execution of the circuit) and in doing so,proves that it has possession of (a) the correct verification key and(b) a valid proof-of-correctness. The verification may be performed byanother computer system (e.g., a node of the blockchain that is averifier) or by either/both of the computing entities that are a partyto the smart contract.

FIG. 5 shows an illustrative example of a process 500 for generating atwo-party common reference string comprising a verification key andevaluation key, in accordance with an embodiment. Some or all of theprocess 500 (or any other processes described herein, or variationsand/or combinations thereof) may be performed under the control of oneor more computer systems configured with computer-executableinstructions and may be implemented as code (e.g., computer-executableinstructions, one or more computer programs, or one or moreapplications) executing collectively on one or more processors, byhardware, software, or combinations thereof. The code may be stored on acomputer-readable storage medium, for example, in the form of a computerprogram comprising a plurality of computer-readable instructionsexecutable by one or more processors. The computer-readable storagemedium may be a non-transitory computer-readable medium. In someembodiments, at least some of the computer-readable instructions usableto perform the process 500 are not stored solely using transitorysignals (e.g., a propagating transient electric or electromagnetictransmission). A non-transitory computer-readable medium may includenon-transitory data storage circuitry (e.g., buffers, caches, andqueues) within transceivers of transitory signals.

In an embodiment, the system performing the process 500 is a computingentity that is a party to a smart contract that performs a process to atleast establish information that can be used by the system and anotherparty of the smart contract to calculate an identical common referencestring. A common reference string described in connection with theprocess 500 may be in accordance with those discussed in connectionwith, for example, FIGS. 1-4 . In an embodiment, the common referencestring is expressed by means of the polynomials v(x), w(x) evaluated ina secret s of the form:v(s)=a ₀ +a ₁ s+a ₂ s ² + . . . +a _(n) s ^(n)w(s)=b ₀ +b ₁ s+b ₂ s ² + . . . +b _(n) s ^(n)

In an embodiment, the first computing entity determines 502 a firstpolynomial to generate a first set of elliptic curve values. In anembodiment, the system generates elliptic curve points of form:

v(s)

_(G)=

a₀

_(G)+

a₁s

_(G)+

a₂s²

_(G)+ . . . , for some generator G of the associated group (e.g., ofelliptic curve points). Unless otherwise noted, the polynomials in thisprocess 500 are defined over a field,

_(r). Thus, let (

_(r), +, ·) be a field. Then, a polynomial over

_(r) is given by P:

→

′ and P(x)=Σ_(i=0) ^(n)a_(i)x^(i) where a_(i)∈

. The set of elliptic curve points may be represented as {

p₁ ^(k)(x_(l))

_(G) _(i) }_(k∈{1, . . . , n},l∈{1,2},i=1).

The first computing entity may make 504 the set of elliptic curve pointsavailable to the second computing entity. In an embodiment, the systemneed not make the entire set of elliptic curve points available to thesecond computing entity—rather in an embodiment, the system transmits asubset of the elliptic curve points {

p₁ ^(k)(x₂)

_(G)}_(k∈{1, . . . , n}).

For example, in accordance with at least one embodiment, where n=2, thefirst computing entity computes {p₁(x₁), p₁ ²(x₁), p₁(x₂), p₁ ²(x₂)} andshares, with the second computing entity, {p₁(x₂), p₁ ²(x₂)}. Theremaining quantities {p₁(x₁), p₁ ²(x₁)} may be utilised by the firstcomputing entity to calculate the common reference string.

The second computing entity, which is also a party to the smartcontract, may separately generate a set of elliptic curve points for thesame input points (e.g., generate elliptic curve points {

p₂ ^(k)(x₁)

_(G)}_(k∈{1, . . . , n})) and provide either all or some of thegenerated points to the first computing entity. The first computingentity may receive 506, from the second computing entity, a second setof elliptic curve points that correspond to some or all of the ellipticcurve points generated by the second computing entity, wherein thesubset may be determined based on techniques described elsewhere in thisdisclosure (e.g., in connection with FIGS. 2 and 6 ).

In an embodiment, the system determines 508 an identical commonreference string based on at least a portion of the first and secondsets of elliptic curve points. For example, after the exchange ofelliptic curve points, a Lagrange interpolation may be utilised toexpress p in terms of p(x₁) and p(x₂). In an embodiment, both parties ofthe smart contract can reconstruct powers

p^(n)(x)

_(G) (and in particular,

p^(n)(0)

_(G)=

s^(n)

_(G)), by means of the exchanged points

p_(i)(x_(j))

_(G). For powers

p^(n)(x)

_(G), the multinomial formula as described above may be utilised:

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + \ldots + {p_{m}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = {\left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots + k_{m}} = n}{\begin{pmatrix}n \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}.}}$

For example, for m=2 this becomes:

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + {p_{2}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = {\left\langle {\sum\limits_{{k_{1} + k_{2}} = n}{\begin{pmatrix}n \\{k_{1},k_{2}}\end{pmatrix}{\prod\limits_{t = 1}^{2}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}.}}$

In an embodiment, additional parameters (e.g., scalar values and/orelliptic curve points) are exchanged between the first and secondcomputing entities, such as in the manner described in connection withFIG. 3 , and the parameters, in conjunction with a power of the sharedsecret

s^(n)

_(G) are utilised to compute the verification key and/or evaluation key.In an embodiment, the parameters are exchanged without reliance onencryption and/or communications channels that provide cryptographicallyverifiable assurances of confidentiality.

In an embodiment, the first and second computing entities agree on atransaction and each makes 510 a contribution to a respectivetransaction input of the smart contract which can be unlocked by a thirdcomputing entity (e.g., worker) that correctly executes the smartcontract. In an embodiment, either of the computing entities provides aproportionate worker fee. There may or may not be a P2SH type agreementin which both make contributions to the same address (e.g., address forworker). In an embodiment, the P2SH script includes elements of theverification key or hash values of the verification key. A worker (e.g.,third computing entity) may unlock (e.g., unlock) the contributions byproviding a computationally verifiable attestation that the worker hasthe correct verification and provides a valid proof of correctness, forexample, by using techniques described in connection with U.K. PatentApplication No. 1719998.5 and/or U.K. Patent Application No. 1720768.9.

FIG. 6 shows an illustrative example of a process 600 for sharing powersof a shared secret between n parties (e.g., n>2), in accordance with atleast one embodiment. Some or all of the process 600 (or any otherprocesses described herein, or variations and/or combinations thereof)may be performed under the control of one or more computer systemsconfigured with computer-executable instructions and may be implementedas code (e.g., computer-executable instructions, one or more computerprograms, or one or more applications) executing collectively on one ormore processors, by hardware, software, or combinations thereof. Thecode may be stored on a computer-readable storage medium, for example,in the form of a computer program comprising a plurality ofcomputer-readable instructions executable by one or more processors. Thecomputer-readable storage medium may be a non-transitorycomputer-readable medium. In some embodiments, at least some of thecomputer-readable instructions usable to perform the process 600 are notstored solely using transitory signals (e.g., a propagating transientelectric or electromagnetic transmission). A non-transitorycomputer-readable medium may include non-transitory data storagecircuitry (e.g., buffers, caches, and queues) within transceivers oftransitory signals. In an embodiment, the equivalent of a threshold isgiven a priori and it is assumed that the necessary number ofparticipants first agree. This differs from various existing techniques,such as those described in Shamir's Secret Sharing Scheme (4S), whereinthe sharing of a secret only works under the limitation that a giventhreshold is reached.

Secret sharing, in accordance with various embodiments, is valid for anarbitrary number of parties. In an embodiment, large parts of theformalism described in this disclosure can be applied to multi-party(n>2) scenarios. In some embodiments, multi-party systems (n>2) are notrequired to conceal certain other parameters (e.g., some or all of thefollowing non-elliptic curve (e.g., scalar) parameters: r_(v), r_(w),α_(v), α_(w), α_(y), β, γ). If, however, those parameters are to remainprivate according to the protocol, different approaches—such as thosedescribed in connection with FIG. 3 —may be utilised to concealparameters such as r_(v), r_(w).

In an embodiment, all participants agree 602 upon and/or have access tothe function ƒ:

→

′ which maps finite field elements to other finite field elements. Thefunctions, in an embodiment, serve as coefficients/exponents ofgenerators of groups. For illustrative purposes, embodiments describedhereinafter focus on polynomials since the functions we are interestedin can be expressed in terms of polynomials by means of generalisationsof Taylor series. In particular, in various embodiments, the partiesinvolved evaluate the functions in the same value and without passingthe value around amongst themselves. For example, in the case of apolynomial of order 1, this amounts to utilising Shamir's Secret SharingScheme. For higher orders (n>1), the parties are dealing withexpressions of the form:ƒ(s)=a ₀ +a ₁ s+a ₂ s ² + . . . +a _(n) s ^(n)

Accordingly, techniques described herein can be utilised to ensure thatall participants have the same

ƒ(s)

_(G). For example, in a protocol described in accordance with at leastone embodiment, the same EQ_FSG can be shared among two or moreparticipants (i.e., n>1) by publically distributing points in the form

s^(r)

_(G), for arbitrary integer powers r, since

ƒ(s)

_(G)=

a₀

_(G)+

a₁s

_(G)+

a₂s²

_(G)+ . . . , where G is a generator of the group in question (e.g., ofelliptic curve points).

In an embodiment, each participant is able to generate 604 polynomials,which are evaluated in a set of points (x₁, x₂, . . . ) with x_(i)≠0 ∀i,and the points may be known to all parties. In an embodiment, the sum ofthe polynomials of each participant makes up the (master) polynomial, ofwhich the intersection with the y-axis is the secret, i.e.,p(x)=Σ_(j=1) ^(m) p _(j)(x)with p(0)=s, and where m is the number of participants. The intersectionwith the y-axis as described above may be referred to as an intersectionpoint.

In order to establish s, each participant shares 606 a correspondingpolynomial evaluated in the different points (x₁, x₂, . . . ). Morespecifically, participant i creates/calculates p_(i)(x_(j)) for i, j∈{1,. . . , m}, and sends off

p_(i)(x_(j))

_(G) to j. Once these quantities are shared, each participant is able tocalculate or otherwise determine 608 a power of the shared secret s^(r).

Slightly more scrutiny is needed when considering s^(r), since itamounts to sharing representations of

$s^{r} = {\left( {p(0)} \right)^{r} = \left( {\sum\limits_{j = 1}^{m}{p_{j}(0)}} \right)^{r}}$

It may not possible to calculate powers of

p_(i)(x_(j))

_(G) because powers of the generator are generally not defined. However,since all participants can infer

s

_(G) by means of the exchanged

p_(i)(x_(j))

_(G), it is possible to start by examining powers of the Lagrangeinterpolation polynomial L(x) (as the master polynomial generally can beconstructed by means of Lagrange interpolation (Lagrange Polynomial,n.d.)). The Lagrange interpolation can be written as:

${L(x)} = {\sum\limits_{j = 1}^{m}{{p\left( x_{j} \right)}{l_{j}(x)}}}$where

${l_{j}(x)} = {\prod\limits_{{1 \leq k \leq m}{k \neq j}}\frac{x - x_{k}}{x_{j} - x_{k}}}$and thus:

${L^{r}(x)} = {\left( {\sum\limits_{j = 1}^{k}{{p\left( x_{j} \right)}{l_{j}(x)}}} \right)^{r} = {\sum\limits_{{k_{1} + k_{2} + \ldots + k_{m}} = r}{\begin{pmatrix}r \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}\left( {{p\left( x_{t} \right)}{l_{t}(x)}} \right)^{k_{t}}}}}}$where

$\begin{pmatrix}r \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix} = \frac{r!}{k_{1}{!{{k_{2}!}\mspace{11mu}\ldots\mspace{11mu}{k_{m}!}}}}$is the multinomial coefficient (Multinomial Theorem, n.d.). Accordingly,the l_(j)(x) polynomials can be calculated by each participantindependently. Next, each participant can calculate:

$\left\langle {L^{r}(x)} \right\rangle_{G} = {\left\langle \left( {\sum\limits_{j = 1}^{m}{{p\left( x_{j} \right)}{l_{j}(x)}}} \right)^{r} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots\; + k_{m}} = r}{\begin{pmatrix}r \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}\left( {{p\left( x_{t} \right)}{l_{t}(x)}} \right)^{k_{t}}}}} \right\rangle_{G}}$such that

p ^(n)(x _(j))

_(G)=

[p ₁(x _(j))+ . . . +p _(k)(x _(j))]^(n)

_(G)which, in turn, can be rewritten as (using the multinomial expansion):

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + \ldots + {p_{k}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots\; + k_{m}} = n}{\begin{pmatrix}n \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}}$

This means that participant i (who is the owner/creator of polynomialp_(i)) can provide participant j with powers of

p_(i)(x_(j))

_(G), i.e., with the set:{

p _(i) ^(k)(x _(j))

_(G)}_(j∈{1, . . . ,m})

This allows participant j to calculate p_(j) ^(l)(x_(j))p_(i)^(k)(x_(j))·G (and similarly p_(j) ^(l)(x_(i))p_(i) ^(k)(x_(i))·G) etc.In an embodiment, a participant calculates expressions on the form:

$\left\langle {L^{r}(x)} \right\rangle_{G} = {\left\langle \left( {\sum\limits_{j = 1}^{m}{{p\left( x_{j} \right)}{l_{j}(x)}}} \right)^{r} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots + k_{m}} = r}{\begin{pmatrix}r \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}{\left( {l_{t}(x)} \right)^{k_{t}}\left( {\sum\limits_{{k_{1}^{\prime} + k_{2}^{\prime} + \ldots + k_{m}^{\prime}} = k_{t}}{\begin{pmatrix}k_{t} \\{k_{1}^{\prime},k_{2}^{\prime},\ldots\;,k_{m}^{\prime}}\end{pmatrix}{\prod\limits_{t^{\prime} = 1}^{m}{p_{t^{\prime}}^{k_{t^{\prime}}^{\prime}}\left( x_{j} \right)}}}} \right)}}}} \right.}$

Consider an example, in accordance with at least one embodiment, inwhich participants use an elliptic curve and where G is a generator inthe corresponding (multiplicative) representation. In the case of twoparticipants, A and B: A sends

p₁(x₂)

_(G) to B, and receives

p₂(x₁)

_(G) in return. Accordingly, participant A can calculate

p(x ₁)

_(G) =

p ₁(x ₁)+p ₂(x ₁)

_(G)and similarly, participant B can calculate:

p(x ₂)

_(G) =

p ₁(x ₂)+p ₂(x ₂)

_(G)

Using Lagrange interpolation it is possible to express p in terms ofp(x₁) and p(x₂):

${p(x)} = {{{{p\left( x_{1} \right)}\frac{x - x_{2}}{x_{1} - x_{2}}} + {{p\left( x_{2} \right)}\frac{x - x_{1}}{x_{2} - x_{1}}}} = {{\frac{{p\left( x_{1} \right)} - {p\left( x_{2} \right)}}{x_{1} - x_{2}}x} + \frac{{{- {p\left( x_{1} \right)}}x_{2}} + {{p\left( x_{2} \right)}x_{1}}}{x_{1} - x_{2}}}}$

Each participant can reconstruct

p(x)

_(G) (and in particular

p(0)

_(G)), by means of the exchanged points

p_(i)(x_(j))

_(G). For higher powers of

p^(n)(x)

_(G), the multinomial formula from the previous section may be utilised:

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + \ldots + {p_{m}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2} + \ldots\; + k_{m}} = n}{\begin{pmatrix}n \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod\limits_{t = 1}^{m}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}}$

For m=2 this becomes:

$\left\langle {p^{n}\left( x_{j} \right)} \right\rangle_{G} = {\left\langle \left\lbrack {{p_{1}\left( x_{j} \right)} + {p_{2}\left( x_{j} \right)}} \right\rbrack^{n} \right\rangle_{G} = \left\langle {\sum\limits_{{k_{1} + k_{2}} = n}{\begin{pmatrix}n \\{k_{1},k_{2}}\end{pmatrix}{\prod\limits_{t = 1}^{2}{p_{t}^{k_{t}}\left( x_{j} \right)}}}} \right\rangle_{G}}$

After this exchange (following certain, pre-arranged conventions) bothparties can calculate

p^(n)(x_(j))

_(G) and, in particular,

p^(n)(0)

_(G)=

s^(n)

_(G).

A protocol according to the process 600 is described hereinbelow. Sinceeach participant needs to be able to obtain expressions of the form

$\left\langle {\begin{pmatrix}n \\{k_{1},k_{2},\ldots\;,k_{m}}\end{pmatrix}{\prod_{t = 1}^{m}{p_{t}^{k_{t}}\left( x_{j} \right)}}} \right\rangle_{G}$an ordering may necessary, when exchanging the points. Here weillustrate one such solution.

Without loss of generality, it can be assumed, in accordance with atleast one embodiment, that participant 1 is the one submitting the firstelliptic curve points. The protocol, in an embodiment, follows thesteps:

-   -   1. Participant 1 distributes        p₁ ^(k) ¹ (x_(j))        _(G) to all i≠1 participants, where k₁=1, . . . , n and j=1, . .        . , m, and where m here is the number of participants    -   2. Participant 2 distributes        p₁ ^(k) ¹ (x_(j))p₂ ^(k) ² (x_(j))        _(G) for k₁=0, . . . , n−1, k₂=1, . . . , n and j=1, . . . , m        to all i≠2 participants    -   3. Participant 3 distributes        p₁ ^(k) ¹ (x_(j))p₂ ^(k) ² (x_(j))p₃ ^(k) ³ (x_(j))        _(G) for k₁=0, . . . , n−1, k₂=0, . . . , n−1, k₃=1, . . . , n        and j=1, . . . , m to all i≠3 participants    -   4. . . . (and so on, for each participant)

The lth participant in the sequence distributes

p₁ ^(k) ¹ (x_(j)) . . . p_(l) ^(k) ^(l) (x_(j))

_(G) for k_(i)=0, . . . , n−1 for i∈{1, . . . , l−1}, k_(l)=1, . . . , nand j=1, . . . , m to all i≠1. When the last participant, m, distributeshis/her points, all the participants have the necessary components tocalculate

s^(n)

_(G)=

p^(n)(0)

_(G).

In an embodiment, the process 600 comprises a plurality of mparticipants (e.g., more than 2 participants) that exchange sets ofpoint of the form {

p₁ ^(k) ¹ (x_(j)) . . . p_(m) ^(k) ^(m) (x_(j))

_(G)} wherein the points are used by each participant to calculate

p^(k)(x_(j))

_(G). The participants may then use the

p^(k)(x_(j))

_(G), together with Lagrange interpolation, to obtain

p^(k)(x_(j))

_(G) and, in particular,

s^(k)

_(G)=

p^(k)(0)

_(G). In an embodiment, the points are elliptic curve points whereinx_(j)≠0 ∀j.

FIG. 7 illustrates a simplified block diagram of a computing device 700that can be used to practice at least one embodiment of the presentdisclosure.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. However, it will beevident that various modifications and changes may be made thereuntowithout departing from the scope of the invention as set forth in theclaims. Likewise, other variations are within the scope of the presentdisclosure. Thus, while the disclosed techniques are susceptible tovarious modifications and alternative constructions, certain illustratedembodiments thereof are shown in the drawings and have been describedabove in detail. It should be understood, however, that there is nointention to limit the invention to the specific form or forms disclosedbut, on the contrary, the intention is to cover all modifications,alternative constructions and equivalents falling within the scope ofthe invention, as defined in the appended claims.

The use of the term “set” (e.g., “a set of items”) or “subset”, unlessotherwise noted or contradicted by context, is to be construed as anonempty collection comprising one or more members. Further, unlessotherwise noted or contradicted by context, the term “subset” of acorresponding set does not necessarily denote a proper subset of thecorresponding set, but the subset and the corresponding set may beequal.

Conjunctive language, such as phrases of the form “at least one of A, B,and C”, or “at least one of A, B and C”, unless specifically statedotherwise or otherwise clearly contradicted by context, is otherwiseunderstood with the context as used in general to present that an item,term, etc., could be either A or B or C, or any nonempty subset of theset of A and B and C. For instance, in the illustrative example of a sethaving three members, the conjunctive phrases “at least one of A, B, andC” and “at least one of A, B and C” refer to any of the following sets:{A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Thus, such conjunctivelanguage is not generally intended to imply that certain embodimentsrequire at least one of A, at least one of B and at least one of C eachto be present. Further, unless stated otherwise or otherwise clear fromcontext, the phrase “based on” means “based at least in part on” and not“based solely on.”

Operations of processes described can be performed in any suitable orderunless otherwise indicated or otherwise clearly contradicted by context.Processes described (or variations and/or combinations thereof) can beperformed under the control of one or more computer systems configuredwith executable instructions and can be implemented as code (e.g.,executable instructions, one or more computer programs or one or moreapplications) executing collectively on one or more processors, byhardware or combinations thereof. In some embodiments, the code can bestored on a computer-readable storage medium, for example, in the formof a computer program comprising a plurality of instructions executableby one or more processors. In some embodiments, the computer-readablestorage medium is non-transitory.

The use of any and all examples, or exemplary language (e.g., “such as”)provided, is intended merely to better illuminate embodiments of theinvention and does not pose a limitation on the scope of the inventionunless otherwise claimed. No language in the specification should beconstrued as indicating any non-claimed element as essential to thepractice of the invention.

Embodiments of this disclosure are described, including the best modeknown to the inventors for carrying out the invention. Variations ofthose embodiments will become apparent to those of ordinary skill in theart upon reading the foregoing description. The inventors expect skilledartisans to employ such variations as appropriate and the inventorsintend for embodiments of the present disclosure to be practicedotherwise than as specifically described. Accordingly, the scope of thepresent disclosure includes all modifications and equivalents of thesubject matter recited in the claims appended hereto as permitted byapplicable law. Moreover, any combination of the above-describedelements in all possible variations thereof is encompassed by the scopeof the present disclosure unless otherwise indicated or otherwiseclearly contradicted by context.

All references, including publications, patent applications, andpatents, cited are hereby incorporated by reference to the same extentas if each reference were individually and specifically indicated to beincorporated by reference and were set forth in its entirety.

It should be noted that the above-mentioned embodiments illustraterather than limit the invention, and that those skilled in the art willbe capable of designing many alternative embodiments without departingfrom the scope of the invention as defined by the appended claims. Themere fact that certain measures are recited in mutually differentdependent claims does not indicate that a combination of these measurescannot be used to advantage.

The invention claimed is:
 1. A computer-implemented method comprising:determining, at a participant of a plurality of participants, a functionusable to map finite field elements, wherein the function is provided tothe plurality of participants; generating, by each participant of theplurality of participants and based on the function, polynomialsevaluated in a set of points; distributing the polynomials, by eachparticipant to each other participant of the plurality of participants,to determine a sum of the polynomials distributed to the plurality ofparticipants; determining a master polynomial from the sum of thepolynomials distributed to the plurality of participants, wherein themaster polynomial corresponds to a power of a secret; and collectivelygenerating, among the plurality of participants and based on the secret,a blockchain transaction.
 2. The computer-implemented method accordingto claim 1, wherein the set of points is a set of elliptic curve points.3. The computer-implemented method according to claim 1, whereindetermining the master polynomial from the sum of the polynomials isbased on a Lagrange interpolation.
 4. The computer-implemented methodaccording to claim 1, further comprising determining, based at least inpart on the power of the secret, a common reference string that isdeterminable by the plurality of participants.
 5. Thecomputer-implemented method according to claim 1, further comprisingreceiving values of the polynomials from each participant of theplurality of participants, the values as evaluated in the set of pointsby each participant.
 6. The computer-implemented method according toclaim 5, wherein off-chain communications are utilised in distributionof the values of the polynomials to each of the other participants. 7.The computer-implemented method according to claim 1, wherein a resultof the function as evaluated serves as a coefficient or exponent of agenerator of a group.
 8. The computer-implemented method according toclaim 1, wherein the plurality of participants is exactly twoparticipants.
 9. The computer-implemented method according to claim 1,wherein the secret is determined based on the master polynomialevaluated at a particular point.
 10. The computer-implemented methodaccording to claim 9, wherein the particular point is an intersectionpoint.
 11. The computer-implemented method according to claim 10,wherein the set of points excludes the intersection point.
 12. Thecomputer-implemented method according to claim 1, wherein thepolynomials evaluated in the set of points are of at least order
 2. 13.The computer-implemented method according to claim 1, wherein each pointof the set of points is a different point.
 14. A system, comprising: aprocessor; and memory including executable instructions that, as aresult of execution by the processor, cause the system to: determine, ata participant of a plurality of participants, a function usable to mapfinite field elements, wherein the function is provided to the pluralityof participants; generate, by each participant of the plurality ofparticipants and based on the function, polynomials evaluated in a setof points; distribute the polynomials, by each participant to each otherparticipant of the plurality of participants, to determine a sum of thepolynomials distributed to the plurality of participants; determine amaster polynomial from the sum of the polynomials distributed to theplurality of participants, wherein the master polynomial corresponds toa power of a secret; and collectively generate, among the plurality ofparticipants and based on the secret, a blockchain transaction.
 15. Thesystem according to claim 14, wherein the set of points is a set ofelliptic curve points.
 16. The system according to claim 14, whereindetermining the master polynomial from the sum of the polynomials isbased on a Lagrange interpolation.
 17. The system according to claim 14,wherein the executable instructions, as a result of execution by theprocessor, further cause the system to determine, based at least in parton the power of the secret, a common reference string that isdeterminable by the plurality of participants.
 18. A non-transitorycomputer-readable storage medium having stored thereon executableinstructions that, as a result of being executed by a processor of acomputer system, cause the computer system to at least: determine, at aparticipant of a plurality of participants, a function usable to mapfinite field elements, wherein the function is provided to the pluralityof participants; generate, by each participant of the plurality ofparticipants and based on the function, polynomials evaluated in a setof points; distribute the polynomials, by each participant to each otherparticipant of the plurality of participants, to determine a sum of thepolynomials distributed to the plurality of participants; determine amaster polynomial from the sum of the polynomials distributed to theplurality of participants, wherein the master polynomial corresponds toa power of a secret; and collectively generate, among the plurality ofparticipants and based on the secret, a blockchain transaction.
 19. Thenon-transitory computer-readable storage medium according to claim 18,wherein the set of points is a set of elliptic curve points.
 20. Thenon-transitory computer-readable storage medium according to claim 18,wherein determining the master polynomial from the sum of thepolynomials is based on a Lagrange interpolation.